vibeview 0.28.1 → 0.30.0

package/dist/{chunk-PBMB6TG4.js → chunk-ZZK7YQSP.js}

@@ -74,6 +74,25 @@ var AuthError = class extends Error {
     this.name = "AuthError";
   }
 };
+var TokenScopeError = class extends AuthError {
+  constructor(message) {
+    super(message);
+    this.name = "TokenScopeError";
+  }
+};
+var SCOPE_REFUSAL_PREFIX = "This API token has the 'ci' scope";
+function credentialError(status, text) {
+  const detail = extractDetail(text);
+  if (status === 401) {
+    return detail && /expired/i.test(detail) ? new AuthError(detail) : new AuthError();
+  }
+  if (status === 403 && detail?.startsWith(SCOPE_REFUSAL_PREFIX)) {
+    return new TokenScopeError(
+      `${detail} Set VIBEVIEW_API_TOKEN (or --token) to a full-access token for this command.`
+    );
+  }
+  return void 0;
+}
 function errorExitCode(err, otherwise = 1) {
   return err instanceof AuthError ? 2 : otherwise;
 }
@@ -168,7 +187,8 @@ var ApiClient = class {
     });
     if (!resp.ok) {
       const text = await resp.text().catch(() => "");
-      if (resp.status === 401) throw new AuthError();
+      const credErr = credentialError(resp.status, text);
+      if (credErr) throw credErr;
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new ApiStatusError(
         resp.status,
@@ -197,7 +217,9 @@ var ApiClient = class {
       device_category: options?.device ? void 0 : options?.deviceCategory,
       device_id: options?.device,
       build_id: options?.build,
-      metadata: options?.metadata
+      metadata: options?.metadata,
+      platform: options?.platform,
+      app_id: options?.app
     });
   }
   async runTest(testId, options) {
@@ -210,7 +232,9 @@ var ApiClient = class {
       device_category: options?.device ? void 0 : options?.deviceCategory,
       device_id: options?.device,
       build_id: options?.build,
-      metadata: options?.metadata
+      metadata: options?.metadata,
+      platform: options?.platform,
+      app_id: options?.app
     });
   }
   /** Cancel a still-queued CI run by its queue entry id. Idempotent best-effort. */
@@ -244,7 +268,8 @@ var ApiClient = class {
     });
     if (!resp.ok) {
       const text = await resp.text().catch(() => "");
-      if (resp.status === 401) throw new AuthError();
+      const credErr = credentialError(resp.status, text);
+      if (credErr) throw credErr;
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new ApiStatusError(
         resp.status,
@@ -267,7 +292,8 @@ var ApiClient = class {
     });
     if (!resp.ok) {
       const text = await resp.text().catch(() => "");
-      if (resp.status === 401) throw new AuthError();
+      const credErr = credentialError(resp.status, text);
+      if (credErr) throw credErr;
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new ApiStatusError(
         resp.status,
@@ -429,7 +455,8 @@ var ApiClient = class {
     const resp = await this.fetchOrExplain(url, { method: "GET", headers });
     if (!resp.ok) {
       const text = await resp.text().catch(() => "");
-      if (resp.status === 401) throw new AuthError();
+      const credErr = credentialError(resp.status, text);
+      if (credErr) throw credErr;
       if (resp.status === 404)
         throw new NotFoundError(`Not found: ${extractDetail(text) ?? `/builds/${id}/artifact`}`);
       throw new ApiStatusError(

package/dist/cli.js

@@ -15,6 +15,7 @@ import {
   listBuilds,
   loadDevConfig,
   newTransitionState,
+  platformLabel,
   platformWithArticle,
   pressButtonsHelp,
   printOutcomeLine,
@@ -22,7 +23,7 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-3DKY443B.js";
+} from "./chunk-NOZGZT3G.js";
 import {
   ApiClient,
   ApiStatusError,
@@ -43,7 +44,7 @@ import {
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-PBMB6TG4.js";
+} from "./chunk-ZZK7YQSP.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -570,6 +571,29 @@ function mapExitCode(status) {
   return EXIT_INFRA_ERROR;
 }
 
+// src/lib/run-target.ts
+var RUN_PLATFORMS = ["ios", "android", "tvos", "androidtv"];
+function parseRunPlatform(value) {
+  if (value === void 0) return void 0;
+  if (!RUN_PLATFORMS.includes(value)) {
+    throw new Error(`--platform must be one of ${RUN_PLATFORMS.join(", ")}, got "${value}"`);
+  }
+  return value;
+}
+function describeRunTarget(response, options) {
+  const asked = Boolean(options.platform || options.app);
+  if (!response.app_id) {
+    if (asked) {
+      throw new Error(
+        "this VibeView server does not support --platform/--app on test runs yet; the run was stopped rather than run on the test\u2019s own platform"
+      );
+    }
+    return null;
+  }
+  if (!asked) return null;
+  return `${response.app_id} (${platformLabel(response.platform ?? "")})`;
+}
+
 // src/commands/run-suite.ts
 async function runSuite(suiteId, options) {
   const { token, baseUrl } = resolveAuth(options);
@@ -635,14 +659,18 @@ ${signal} received.
       deviceCategory: options.deviceCategory,
       device: options.device,
       build: options.build,
-      metadata: options.metadata
+      metadata: options.metadata,
+      platform: options.platform,
+      app: options.app
     });
     sessionId = response.session_id;
     runId = response.run_id;
+    const target = describeRunTarget(response, options);
     spinner.stop();
     process.stderr.write(
       `${chalk3.dim("Suite:")} ${suiteId}
-${chalk3.dim("Run:")} ${response.run_id}
+` + (target ? `${chalk3.dim("App:")} ${target}
+` : "") + `${chalk3.dim("Run:")} ${response.run_id}
 ` + (sessionId ? `${chalk3.dim("Session:")} ${sessionId}
 ` : "")
     );
@@ -1009,16 +1037,20 @@ ${signal} received.
       deviceCategory: options.deviceCategory,
       device: options.device,
       build: options.build,
-      metadata: options.metadata
+      metadata: options.metadata,
+      platform: options.platform,
+      app: options.app
     });
     sessionId = response.session_id;
     runId = response.run_id;
+    const target = describeRunTarget(response, options);
     spinner.stop();
     process.stderr.write(
       `${chalk5.dim("Session:")} ${sessionId || "unknown"}
 ${chalk5.dim("Device:")} ${response.device_name || "allocating..."}
 ${chalk5.dim("Test:")} ${testId}
-${chalk5.dim("Run:")} ${response.run_id}
+` + (target ? `${chalk5.dim("App:")} ${target}
+` : "") + `${chalk5.dim("Run:")} ${response.run_id}
 `
     );
     spinner.start("Waiting for device...");
@@ -1785,7 +1817,8 @@ function defaultDeps2(client) {
     getSubmission: client.getSubmission.bind(client),
     getSubmissionLog: client.getSubmissionLog.bind(client),
     listCloudBuilds: client.listCloudBuilds.bind(client),
-    checkStorePreflight: client.checkStorePreflight.bind(client)
+    checkStorePreflight: client.checkStorePreflight.bind(client),
+    getApp: client.getApp.bind(client)
   };
 }
 var POLL_INTERVAL_MS2 = 2e3;
@@ -1910,7 +1943,7 @@ async function submitCommand(opts, deps) {
   }
   if (rollout !== void 0 && releaseStatus !== "inProgress") {
     throw new UsageError(
-      `a rollout fraction requires release status "inProgress" (a staged rollout) \u2014 got "${releaseStatus ?? "completed"}"`
+      `a rollout fraction requires release status "inProgress" (a staged rollout) \u2014 got "${releaseStatus ?? (track === "production" ? "draft" : "completed")}"`
     );
   }
   if (releaseStatus === "inProgress" && rollout === void 0) {
@@ -1964,12 +1997,19 @@ async function submitCommand(opts, deps) {
   }
 }
 async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
-  const identifier = androidFamily ? opts.package : opts.bundleId;
+  const flagged = androidFamily ? opts.package : opts.bundleId;
+  const usage = androidFamily ? `--check needs the package name to look up: --package <name> (e.g. --package io.example.app)` : `--check needs the bundle identifier to look up: --bundle-id <id> (e.g. --bundle-id io.example.app)`;
+  let identifier = flagged;
   if (!identifier) {
-    throw new UsageError(
-      androidFamily ? `--check needs the package name to look up: --package <name> (e.g. --package io.example.app)` : `--check needs the bundle identifier to look up: --bundle-id <id> (e.g. --bundle-id io.example.app)`
-    );
+    try {
+      identifier = await linkedIdentifier(platform, opts, deps);
+    } catch (err) {
+      printError2(opts, err);
+      process.exitCode = errorExitCode(err);
+      return;
+    }
   }
+  if (!identifier) throw new UsageError(usage);
   try {
     const result = await deps.checkStorePreflight({
       platform,
@@ -1994,6 +2034,32 @@ async function checkStore(platform, androidFamily, ascKey2, opts, deps) {
     process.exitCode = errorExitCode(err);
   }
 }
+async function linkedIdentifier(platform, opts, deps) {
+  if (!deps.getApp) return void 0;
+  let appId;
+  try {
+    appId = loadDevConfig(process.cwd())?.platforms?.[platform]?.appId;
+  } catch {
+    return void 0;
+  }
+  if (!appId) return void 0;
+  let app;
+  try {
+    app = await deps.getApp(appId);
+  } catch (err) {
+    if (err instanceof NotFoundError) {
+      throw new Error(
+        `the app linked in vibeview.json for ${platform} (${appId}) no longer exists \u2014 ` + (platform === "android" || platform === "androidtv" ? "pass --package <name>" : "pass --bundle-id <id>")
+      );
+    }
+    throw err;
+  }
+  if (!app.package_name) return void 0;
+  if (!opts.json) {
+    console.error(chalk14.dim(`Checking ${app.package_name} (${app.name}, linked in vibeview.json)`));
+  }
+  return app.package_name;
+}
 async function resolveLatestBuild(platform, deps) {
   const { builds: builds2 } = await deps.listCloudBuilds({
     platform,
@@ -3534,11 +3600,24 @@ program.command("run-suite <suite-id>").description("Run all test cases in a sui
 ).option(
   "--device <device_id>",
   "Pin run to a specific device (use `vibeview list-devices` to find one). Conflicts with --device-category."
+).option(
+  "--platform <platform>",
+  "Run the suite on another platform (ios, android, tvos, androidtv): runs your app there with the same bundle id / package"
+).option(
+  "--app <app-id>",
+  "Run the suite against this app instead of its own (e.g. another platform build with a different bundle id)"
 ).option("--build <id>", "Specific AppBuild id to run against (defaults to latest)").option("--metadata <json>", "JSON object passed through to webhooks (e.g. PR context)").option("--metadata-file <path>", "Read JSON object from a file (use for nested JSON in CI)").action((suiteId, opts) => {
   if (opts.device && opts.deviceCategory) {
     process.stderr.write("error: --device cannot be combined with --device-category\n");
     process.exit(2);
   }
+  try {
+    parseRunPlatform(opts.platform);
+  } catch (err) {
+    process.stderr.write(`error: ${err.message}
+`);
+    process.exit(2);
+  }
   const metadata = resolveMetadata(opts);
   return runSuite(suiteId, {
     ...opts,
@@ -3567,6 +3646,13 @@ program.command("run-suites").description("Run all suites matching a tag filter"
     process.stderr.write("error: --device cannot be combined with --device-category\n");
     process.exit(2);
   }
+  try {
+    parseRunPlatform(opts.platform);
+  } catch (err) {
+    process.stderr.write(`error: ${err.message}
+`);
+    process.exit(2);
+  }
   const metadata = resolveMetadata(opts);
   return runSuites({
     ...opts,
@@ -3582,11 +3668,24 @@ program.command("run-test <test-id>").description("Run a single test case").opti
 ).option(
   "--device <device_id>",
   "Pin run to a specific device (use `vibeview list-devices` to find one). Conflicts with --device-category."
+).option(
+  "--platform <platform>",
+  "Run the test on another platform (ios, android, tvos, androidtv): runs your app there with the same bundle id / package"
+).option(
+  "--app <app-id>",
+  "Run the test against this app instead of its own (e.g. another platform build with a different bundle id)"
 ).option("--build <id>", "Specific AppBuild id to run against (defaults to latest)").option("--metadata <json>", "JSON object passed through to webhooks (e.g. PR context)").option("--metadata-file <path>", "Read JSON object from a file (use for nested JSON in CI)").action((testId, opts) => {
   if (opts.device && opts.deviceCategory) {
     process.stderr.write("error: --device cannot be combined with --device-category\n");
     process.exit(2);
   }
+  try {
+    parseRunPlatform(opts.platform);
+  } catch (err) {
+    process.stderr.write(`error: ${err.message}
+`);
+    process.exit(2);
+  }
   const metadata = resolveMetadata(opts);
   return runTest(testId, {
     ...opts,
@@ -3635,7 +3734,10 @@ program.command("dev").description(
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--web-url <url>", "Dashboard URL if different from the API URL (local dev)").option(
   "--platform <platform>",
   "ios, android, tvos, androidtv, or roku (first run is interactive otherwise)"
-).option("--app <app_id>", "Uploaded debug build to run (see `vibeview list-apps`)").option("--metro-port <port>", "Local Metro port (default: 8081, remembered in vibeview.json)").option(
+).option("--app <app_id>", "Uploaded debug build to run (see `vibeview list-apps`)").option(
+  "--metro-port <port>",
+  "Local Metro port (default: 8081, or vibeview.json); remembered for you in .vibeview/local.json"
+).option(
   "--device-category <category>",
   "phone or tablet (default: phone; TV platforms always use tv)",
   parseDeviceCategory
@@ -3648,11 +3750,15 @@ program.command("dev").description(
   false
 ).option(
   "--build [id]",
-  "Bare: build and upload first (uses platforms.<platform>.build from vibeview.json). With an id: run that uploaded debug build instead of the newest one (see `vibeview list-builds <app>`)",
+  "Bare: build and upload first (uses platforms.<platform>.build from vibeview.json). With an id: run that uploaded debug build instead of the newest one (any build with --standalone) (see `vibeview list-builds <app>`)",
   false
 ).option(
   "--watch [seconds]",
   "Roku only: auto-reload after file changes settle (default: 2 seconds of quiet)"
+).option(
+  "--standalone",
+  "Run the build as it is, with no Metro and no tunnel (a release, CI or cloud build); without --build <id>, the newest release build. Code changes do not hot-reload",
+  false
 ).action((opts) => dev(opts));
 program.command("build").description("Run your configured build command and upload the result (see vibeview.json)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option(
   "--platform <platform>",
@@ -3687,13 +3793,13 @@ program.command("submit").description(
   "ios/tvos only: which stored App Store Connect key to use (default when exactly one \u2014 see `vibeview credentials asc-key add`)"
 ).option(
   "--release-status <status>",
-  "android/androidtv only: Play release status \u2014 completed (default), draft, or inProgress"
+  "android/androidtv only: Play release status \u2014 completed, draft, or inProgress (default: draft on the production track, completed on the others)"
 ).option(
   "--rollout <fraction>",
   "android/androidtv only: staged-rollout fraction, 0 < f < 1 (requires --release-status inProgress)"
 ).option(
   "--check",
-  "Only check store readiness: does the store know this app with your stored key? Takes --platform plus --bundle-id (ios/tvos) or --package (android/androidtv); no build needed. Exit 0 when ready",
+  "Only check store readiness: does the store know this app with your stored key? Takes --platform plus --bundle-id (ios/tvos) or --package (android/androidtv), defaulting to the app linked in vibeview.json; no build needed. Exit 0 when ready",
   false
 ).option("--bundle-id <id>", "ios/tvos, with --check: the bundle identifier to look up").option("--no-wait", "Print the submission id and exit without waiting for completion").option("--json", "Emit line-delimited JSON events on stdout instead of human output", false).action((opts) => submitCommand(opts));
 var builds = program.command("builds").description("Manage cloud builds (see `vibeview build --cloud`)");
@@ -3793,7 +3899,7 @@ program.command("dev-reload").description(
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop/dev_reload as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-BGQJOVSN.js");
+  const { runMcpServer } = await import("./server-2JNYWF5L.js");
   await runMcpServer({ ...opts, version: pkg.version });
 });
 program.command("agent-setup").description(

package/dist/{server-BGQJOVSN.js → server-2JNYWF5L.js}

@@ -11,22 +11,25 @@ import {
   checkMetro,
   createRokuPush,
   decodeScreenshotResult,
+  effectiveDevConfig,
   filterDeviceModels,
   formatBuildRowsHuman,
   formatDeviceModelsHuman,
   isDevPlatform,
   loadDevConfig,
+  loadLocalDevConfig,
   parseBuildId,
   platformWithArticle,
   readDevState,
   renderEnvelope,
+  resolveMetro,
   startDevSession
-} from "./chunk-3DKY443B.js";
+} from "./chunk-NOZGZT3G.js";
 import {
   ApiClient,
   NotFoundError,
   resolveAuth
-} from "./chunk-PBMB6TG4.js";
+} from "./chunk-ZZK7YQSP.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -539,7 +542,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-FEZG23NU.js");
+    const { uploadAppBuild } = await import("./upload-app-2LVG4LMB.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });
@@ -624,6 +627,7 @@ function createDevSessionController(auth, webUrl) {
       } catch {
         devConfig = null;
       }
+      devConfig = effectiveDevConfig(devConfig, loadLocalDevConfig(process.cwd()));
       const entry = devConfig?.platforms?.[cfg.platform];
       const appId = cfg.app || entry?.appId;
       if (!appId) {
@@ -649,7 +653,7 @@ function createDevSessionController(auth, webUrl) {
       }
       const standalone = cfg.standalone === true;
       const usesMetro = PLATFORM_NEEDS_METRO[cfg.platform] && !standalone;
-      const metroPort = cfg.metroPort ?? devConfig?.metroPort ?? 8081;
+      const metroPort = resolveMetro(devConfig, cfg.platform, cfg.metroPort).port;
       if (usesMetro) {
         const metro = await checkMetro(metroPort);
         if (metro === "down") {

package/dist/{upload-app-FEZG23NU.js → upload-app-2LVG4LMB.js}

@@ -3,7 +3,7 @@ import {
   describeBuild,
   uploadApp,
   uploadAppBuild
-} from "./chunk-PBMB6TG4.js";
+} from "./chunk-ZZK7YQSP.js";
 export {
   describeBuild,
   uploadApp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.28.1",
+  "version": "0.30.0",
   "description": "VibeView CLI -- run your app on cloud iOS simulators, Android emulators, Apple TV, Android TV and Roku (beta) devices: a React Native dev loop, device control for you or your coding agent (CLI or MCP), and tests from CI",
   "mcpName": "io.github.vibeview/vibeview",
   "type": "module",

package/skills/vibeview-agent/SKILL.md

@@ -64,11 +64,15 @@ https://vibeview.io/docs/preparing-your-build.
    the page is `https://vibeview.io/sandbox/<session_id>`.)
 
 Running `dev` writes two things into the project root: a `.vibeview/`
-directory (live session state — local machine state, never commit) and a
-`vibeview.json` (your platform/app/build choices, which teammates DO want).
-Make sure `.vibeview/` is in the project's `.gitignore`, adding it if
-missing. Leave `vibeview.json` tracked, but tell the developer you created
-it rather than letting it appear unexplained in their `git status`.
+directory (live session state, plus `local.json` with this developer's own
+flag overrides such as `--metro-port` — local machine state, never commit)
+and a `vibeview.json` (the platform/app/build setup, which teammates DO
+want). Flags never rewrite a value `vibeview.json` already has; they are
+saved to `.vibeview/local.json` instead, and the CLI prints what it saved.
+Make sure the project's `.gitignore` has `.vibeview/*` and
+`!.vibeview/test-spec.json`, adding them if missing. Leave `vibeview.json`
+tracked, but tell the developer you created it rather than letting it
+appear unexplained in their `git status`.
 
 ## 3. Verifying